Website hacked: what a small business should do

Take the site offline, change every password, restore a clean backup, then find how they got in. Doing it in the wrong order lets them straight back.

A1 Digital · written & reviewed by the team 7 October 2026 4 min read Updated 7 October 2026

Quick answer

If your website is hacked, take it offline, change every password from a different device, restore a clean backup, then close the hole they came through. Restoring before finding the entry point simply gets you hacked again within days.

Order matters

restore before closing the hole and it happens again

Every password

hosting, site, database, email, FTP, all of them

Outdated plugins

the most common way small business sites get compromised

Take the site offline, change every password, restore a clean backup, then find how they got in. The order matters more than the speed. Restoring a backup without closing the entry point means you are compromised again within days, usually by the same automated process.

Do this in order

1. Take the site offline

Maintenance mode or a holding page. This stops visitors being exposed to malware and stops the damage to your reputation while you work. Your host can do this in minutes if you cannot.

2. Change every password, from a clean device

Hosting, website admin, database, FTP, email, and anything reusing the same password. Use a device you trust, because if your own machine is compromised you are handing over the new passwords too.

3. Tell your host

They often spot these before you do, they can see server logs, and many will help clean it or point you at what happened. This is a normal support request for them.

4. Restore a clean backup

One from before the compromise. Check the date carefully, because infections often sit quietly for weeks before doing anything visible.

5. Find and close the entry point

Usually an outdated plugin, theme or CMS version. Update everything, remove anything unused, and check for admin users you do not recognise.

6. Then put it back online

And request a review in Google Search Console if your site was flagged with a warning.

Key takeaway

Step five is the one people skip because the site looks fine after a restore. Automated attacks re-scan the same targets constantly. If the hole is still there, you will be cleaning this up again next week.

How it usually happened

Not a targeted attack. For small businesses it is almost always automated scanning finding a known weakness.

Outdated plugins, themes or CMS. By far the most common. A vulnerability is published, automated tools scan the whole internet for sites that have not updated, and yours is found. Not personal, just unpatched.

Weak or reused passwords. An admin password that is also used elsewhere and has appeared in a breach.

Abandoned plugins. Something installed years ago, no longer maintained by its developer, never removed.

Old admin accounts. A previous developer’s account still active with a password nobody has changed.

All four are preventable and all four are boring, which is exactly why they keep working.

Check the backup date carefully

Compromises frequently sit dormant for weeks before doing anything visible. If you restore last week’s backup, you may be restoring an already-infected site. Go back further than feels necessary, and if your only backups are recent, expect to need proper cleaning rather than a restore.

Do not just restore and hope

Two things worth checking beyond the obvious cleanup.

Unknown admin users. Attackers commonly add one so they can return after you clean up. Look at the user list on your site and remove anything you do not recognise.

Scheduled tasks and injected files. Some infections leave behind code that reinstalls itself. If the site keeps getting reinfected after a clean restore, this is usually why, and it is the point to bring in someone who does this professionally.

The Google warning

If Google flagged your site, visitors see a red warning screen and effectively nobody enters.

Once the site is genuinely clean, request a review through Google Search Console. Reviews typically take a few days. Do not request one before the site is clean, because a failed review can slow things down.

Rankings usually recover once the warning is lifted, though there can be a dip. The bigger cost is the days when nobody could visit.

The data question

If personal data may have been accessed, customer details, enquiry form submissions, anything identifying people, this stops being purely technical.

Under UK GDPR you need to assess whether the breach is notifiable to the ICO, generally within 72 hours of becoming aware, and whether affected individuals need telling. Small brochure sites often hold more than owners realise: months of contact form submissions sitting in a database.

Take proper advice on your specific circumstances rather than assuming it does not apply. What is GDPR for websites covers the basics of what sites typically hold.

Preventing the next one

Genuinely not complicated, and it is mostly maintenance:

Keep everything updated. Core, plugins, themes. This alone prevents the large majority of small business compromises.
Remove what you do not use. Every inactive plugin is a door you are not watching.
Strong unique passwords, in a password manager. Plus two-factor authentication on hosting and site admin.
Backups that are off the server and tested. A backup on the same server that got compromised is not a backup.
Remove old accounts. Previous developers, former staff, anyone who no longer needs access.

That is what a maintenance plan is buying, and it is the argument for having one. Website security checklist has the fuller list and why backups matter covers the restore side.

What this costs

Cleaning a compromised site professionally typically runs a few hundred pounds, plus the lost enquiries during the days it was offline or flagged.

Maintenance that would have prevented it costs £15-£50 a month. That comparison is the entire argument, and it is why the cheapest websites are frequently the most expensive ones.

Our managed plans include updates, security and tested backups from £49 a month. If your site is compromised right now, tell us what you are seeing and we will tell you honestly whether it is something your host can sort out for free.

Frequently asked questions

My website has been hacked. What do I do first?

Take the site offline or into maintenance mode so visitors are not exposed, then change every related password from a device you trust. Contact your host, since they often detect and can help clean these. Only then restore a clean backup, and find the entry point before putting it back online.

How do websites get hacked?

Most small business compromises come through outdated plugins, themes or CMS versions with known vulnerabilities, or through weak and reused passwords. Both are preventable. Targeted attacks on small businesses are rare; automated scanning for known holes is constant.

Will being hacked affect my Google rankings?

It can. Google may flag the site with a warning in search results or browsers, which stops visitors entering. Clean the site, then request a review through Google Search Console to have the warning removed. Rankings usually recover once the site is clean and the warning lifted.

Do I need to tell anyone if my website is hacked?

If personal data may have been accessed, UK GDPR requires you to consider notifying the ICO, generally within 72 hours of becoming aware, and to tell affected individuals in higher-risk cases. Take advice on your specific situation rather than assuming a brochure site is exempt.

hacked security malware recovery backups emergency

Share Link copied

Written by the A1 Digital team

We handle the entire online presence for small businesses, website, branded email, Google, AI search, content and reviews, for one simple monthly plan. No tech headaches, no lock-in.

View plans Contact us

Keep reading

List